OMG, this is a bit embarrassing! I rebooted both APs, and Finally! FT is working! 
(typical did you try "turning it off and on again")
And the strangest part is that my config was right all along from the beginning. It's very strange and I tried to recall what I have done on the APs. AP#2 was not touched at all, all of my changes were done on AP#1.
At one point (within the past two weeks) I tried creating a vlan on AP#1 which didn't work out for some reason so I reverted back the configuration. Then I created this post when I discovered that the FT was not working properly. I tried the reassociation_deadline or max_inactivity on AP#1 and AP#2 but that didn't solve the problem so I reverted. Finally I thought of updating firewall package on AP#1. Then I tried updating the packages on AP#1, and the firewall package got updated. Afterwards I realized that the iptables were loaded with fw3 rules on AP#1 but there were none in AP#2 (here I'm not sure if the iptables were loaded before the firewall package upgrade or afterwards, but my guess was afterwards as I reviewed the upgrade output and it showed it was loading the rules). I ran /etc/init.d/firewall stop which removed all the rules, but that also didn't fix the FT. Finally I decided to try rebooting the APs (both of them) and that finally did the trick.
I'll try to keep an eye on this issue, hopefully I could catch the culprit that caused all of this. But indeed it was something on the lan ports/switch side, just literally blocking the packets after FT (I wished I could figure out what was going in the switch, via the commands, I just don't know how).
The weird thing is that after performing full wifi handshake with any of the APs, the packets for the phone would go through without any problems. On top of that and when the problem was still happening, I would also notice that the device wouldn't be able to get dhcp-reply after doing full wifi handshake, this behavior happens for a few minutes and then eventually the packets are unblocked and the device receives dhcp-reply and connects successfully.
Now AP#1->AP#2->AP#1->AP#2->AP#1->AP#2->... works beautifully, even with secondary ssid's on the wlan nic.
This is how a disabled firewall should look like in iptables (there is no need to remove /etc/config/firewall, just disabling it and stopping the firewall service will do the trick):
~# iptables -L -v -n
Chain INPUT (policy ACCEPT 8406 packets, 683K bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 3 packets, 1002 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 5063 packets, 2618K bytes)
pkts bytes target prot opt in out source destination
And here's my config (didn't even need reassociation_deadline or max_inactivity):
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid '<redacted>'
option dtim_period '3'
option encryption 'psk2'
option key '<redacted>'
option ieee80211r '1'
option mobility_domain '123F'
option ft_over_ds '0'
option ft_psk_generate_local '1'
Thanks for everyone's replies and suggestions.
